{{- if and .Values.wordpress.enabled .Values.database.cluster.enabled }}
{{- /*
Placeholder Secret that bp-reflector + the post-install sync Job
populate from the CNPG-generated `<cluster>-app` Secret.

WordPress reads the database password from WORDPRESS_DB_PASSWORD; the
Deployment binds it via secretKeyRef to this Secret's `password` key.
CNPG produces `<cnpgClusterName>-app` with a `password` key. This
Secret acts as the bridge: reflector copies all keys from
`<cluster>-app` into this Secret; the post-install Job in
templates/database-secret-sync-job.yaml provides the safety net for
the otech30-class Reflector race documented in
platform/gitea/chart/templates/database-secret-sync-job.yaml.

Per docs/INVIOLABLE-PRINCIPLES.md #10 (credential hygiene): no
plaintext credentials appear in this committed template — only an
empty placeholder. Reflector / the sync Job copy bytes from a live
cluster Secret at runtime.
*/}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.database.secretName }}
  namespace: {{ include "bp-wordpress-tenant.cnpgNamespace" . | quote }}
  labels:
    {{- include "bp-wordpress-tenant.labels" . | nindent 4 }}
  annotations:
    # Reflector copies all keys from <cluster>-app into this Secret.
    reflector.v1.k8s.emberstack.com/reflects: "{{ include "bp-wordpress-tenant.cnpgNamespace" . }}/{{ include "bp-wordpress-tenant.cnpgAppSecret" . }}"
    # Helm resource-policy keep — do not delete on `helm uninstall`
    # (the Secret is independently managed by reflector + the
    # post-install Job after initial creation).
    helm.sh/resource-policy: keep
type: Opaque
# Bootstrap empty data — reflector / the post-install Job overwrites
# `password` once CNPG finishes provisioning <cluster>-app. Empty
# values here prevent CreateContainerConfigError (secret key missing)
# during initial render.
data:
  password: ""
{{- end }}
